TCP Low Rate DDoS Attack Detection

Abstract

Undoubtedly one of the more significant attacks on computer networks is distributed denial of service (DDoS). DDoS assaults can be divided into two groups: high rate attacks and low rate attacks. In the high rate DDoS category, the attacker tries to use all of the bandwidth available on the channel by saturating it with packets. While maintaining a low average transmission rate, the attacker conducts a DDoS attack in the low rate DDoS category (also known as LDDoS). TCP LDDoS is a low-rate DDoS assault in which the attacker takes advantage of the way TCP handles congestion. In this article, we look into a system for stopping a TCP LDDoS attack and suggest a fresh approach. We offer several observations to help distinguish between appropriate behavior and an attack. Our system produces a priority queue of flows, where flows with a high priority are valid and flows with a low priority are suspect. Using the NS2 simulation environment, we assess the suggested system. Results demonstrate that our suggested approach can accurately distinguish between attack flows and genuine flows.